This vulnerability arises from unescaped input in the ask_db function of the mindsql_core.py module. An attacker can supply crafted SQL statements that are then executed directly against the database, enabling unauthorized read, modification, or deletion of data. The weakness aligns with CWE‑74 (Untrusted Input Reflected in Command) and CWE‑89 (SQL Injection). The potential impact is the compromise of database contents and operations, which could lead to loss of confidentiality, integrity, or availability of the application.

The affected product is Mindinventory MindSQL, with all releases up to and including version 0.2.1. No other versions are listed as impacted in the current data set. The vulnerability is present in the core module's ask_db functionality.

The CVSS score is 5.3, indicating moderate severity. No exploit probability score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely without prior authentication, and malicious users can inject arbitrary SQL statements into the application. Because the vulnerability has been publicly disclosed, the likelihood of exploitation is non‑negligible, especially for instances exposed to untrusted networks.